Sentinel

SENTINEL is a Qwen-powered multi-agent war room that audits Solidity protocols with adversarial agents, real EVM traces, persistent memory, and human-gated risk decisions.

Comment

Inspiration

Most AI audit demos look confident, but confidence is cheap. The hard part is accountability.

Smart contract teams do not just need another model that says “this looks vulnerable.” They need a system that can argue over deployment readiness, prove its claims with execution evidence, remember past incidents, and stop when a human decision is required.

That is why I built SENTINEL: a Qwen-powered adversarial war room for Solidity protocol audits.

The core idea is simple: production risk is rarely solved by one perfect answer. It is usually a fight between competing priorities. Shipping fast matters. Security matters. Gas cost matters. Business constraints matter. Sometimes there is no clean solution. SENTINEL is designed to expose that tension instead of hiding it behind a polished AI response.

What it does

SENTINEL audits Solidity/EVM protocols using a society of Qwen agents with structurally opposed roles:

  • Yield Agent argues for deployability, efficiency, and business requirements.
  • Adversary Agent attacks the contract, raises vetoes, and blocks unsafe proposals.
  • Arbitrator Agent resolves disagreements or declares constraints unsatisfied.
  • Lessons Agent retrieves cross-session memory from prior audit incidents.
  • Baseline Agent runs a single-pass audit so SENTINEL can be compared against a simpler agent.

The agents do not just chat. They negotiate over real contract artifacts and tool results. When the Adversary makes a claim about gas, revert rate, exploitability, or patch verification, SENTINEL ties that claim to a trace from the local EVM simulation layer.

The web interface visualizes this as a live War Room: each agent has a lane, vetoes are visible, arbitration rulings are recorded, trace chips can be inspected, and risky actions are paused behind a human checkpoint.

SENTINEL also supports uploaded Solidity contracts. If dynamic verification cannot be completed, the system says so clearly instead of pretending the patch is verified. That behavior is intentional. A production-grade agent should degrade honestly.

How I built it

SENTINEL is built around a custom orchestration layer and three custom MCP-style tool servers:

CodebaseMCP

Handles contract reading, function listing, patch proposal, patch diffing, and gated patch application. Patch application is never automatic. It must pass through the human checkpoint.

SimulationMCP

Runs EVM execution through a local Foundry/Anvil sandbox. It supports deployment, gas measurement, revert-rate checks, transaction spike scenarios, exploit replay, and patch verification. This is the evidence backbone of the system.

MemoryMCP

Stores audit post-mortems and prior incidents in a persistent memory layer. During later audits, the Lessons Agent retrieves relevant records and injects them as constraints. The memory is not used as a generic RAG dump. It is used to make the negotiation more realistic.

The frontend is a browser War Room built with a live event stream. The same structured trace events that power the logs also power the UI. That keeps the demo honest: the visual story is not separate from the audit record.

The Qwen agents run through Qwen Cloud’s OpenAI-compatible API. The project also includes deterministic demo drivers so the core system can be tested without credentials, but the live mode uses real Qwen calls.

Key features

  • Multi-agent negotiation with opposed mandates
  • Real EVM sandbox execution with Foundry/Anvil
  • Custom MCP integrations for code, simulation, and memory
  • Trace-backed evidence for high-stakes claims
  • Persistent cross-session memory
  • Single-agent baseline comparison
  • Human checkpoint gate for risky decisions
  • Browser-based War Room UI
  • Uploaded Solidity contract audit flow
  • Honest degraded states when verification is incomplete
  • Docker/Alibaba Cloud deployment path

What makes it different

SENTINEL does not optimize for a confident answer. It optimizes for an accountable decision.

If the agents agree, the system records why. If the Adversary vetoes, the veto must be justified. If a patch is proposed, it is staged and reviewed. If verification fails, the system marks the result as unverified. If risk remains, a human must decide whether to reject, escalate, or accept the residual risk.

That refusal to fake certainty is the point.

Challenges I faced

The hardest part was not getting Qwen to produce useful audit reasoning. The hard part was making the system production-honest.

A few examples:

  • Uploaded contracts initially landed in a gitignored folder, so patch staging failed.
  • Missing patch IDs were being treated like protocol disagreement instead of tool failure.
  • Some UI states allowed approval even when no staged patch existed.
  • Dynamic verification sometimes failed because staged patches did not produce deployable artifacts.
  • SSE streams needed to handle disconnects cleanly.
  • Uploaded contract runs needed a different payoff screen from the full showcase flow.

Each of those bugs forced the system to become more honest. Tool failure is not protocol risk. Static analysis is not exploit proof. A deploy trace is not proof of a reentrancy claim. An unavailable verification path must not become a fake green checkmark.

What I learned

I learned that building serious agents is less about making models talk and more about designing the boundaries around them.

The model should reason, but the system should own the guarantees. Typed schemas, trace validation, checkpoint gates, structured logs, and tool-specific evidence rules matter as much as the prompts.

I also learned that multi-agent systems are only interesting when the agents are allowed to disagree for real. If every agent is just politely helping the next one, it becomes a pipeline with costumes. SENTINEL’s value comes from the fact that the agents can block each other, escalate unresolved tension, and produce a risk profile instead of forcing consensus.

Accomplishments

I am proud that SENTINEL now has a full working loop:

  • It runs Qwen-powered agents live.
  • It audits Solidity contracts.
  • It produces visible multi-agent negotiation.
  • It connects audit claims to real tool traces.
  • It compares against a single-agent baseline.
  • It retrieves different memories across sessions.
  • It blocks risky actions behind a human checkpoint.
  • It handles arbitrary uploaded contracts without pretending incomplete verification is complete.

The result feels less like a chatbot and more like an engineering control system.

What is next

The next step is making SENTINEL easier to adopt in real protocol workflows.

Planned improvements include:

  • CI/CD integration for pre-deployment audit gates
  • More exploit harnesses for common Solidity vulnerability classes
  • Better staged patch compilation and artifact resolution
  • GitHub pull request comments with trace-backed findings
  • Slack or email approval flows for human checkpoints
  • Richer memory decay and supersession logic
  • Open-source packaging of CodebaseMCP and SimulationMCP as standalone tools

Long term, SENTINEL could become a first-pass adversarial review layer for protocol teams and audit firms. Not a replacement for human auditors, but a system that makes the first review sharper, faster, and more accountable.

Built With

Share this project:

Updates